794559 - Some "Exceptions" to "Remember passwords for sites" are ignored

Status: RESOLVED WORKSFORME

(Firefox :: Untriaged, defect)

Description

[paul.hoffman]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:15.0) Gecko/20100101 Firefox/15.0.1
Build ID: 20120905151427

Steps to reproduce:

Logged into a site that I have listed as an exception to "Remember passwords for sites"


Actual results:

My password was entered in the form


Expected results:

My password should not have been entered in the form

Comment 1

[paul.hoffman]

I'd rather not expose all my personal info to the world, but I can easily make a screencast showing this and give it to one of the many of you security devs at Moz whom I know.

Comment 2

[Loic]

Which website? Please, post an URL if possible.

Comment 3

[paul.hoffman]

(In reply to Loic from comment #2)
> Which website? Please, post an URL if possible.

https://www.scccu.org/

Comment 4

[Loic]

Ah, it's online banking, so I guess I can't access and test myself.

Anyway, delete the current password and the exception for this website then try to login and add a new exception if the website allow to save the password (it should NOT be the case if the website is well coded)
http://support.mozilla.org/en-US/kb/password-manager-remember-delete-change-passwords

Comment 5

[paul.hoffman]

(In reply to Loic from comment #4)
> Ah, it's online banking, so I guess I can't access and test myself.
> 
> Anyway, delete the current password and the exception for this website then
> try to login and add a new exception if the website allow to save the
> password (it should NOT be the case if the website is well coded)
> http://support.mozilla.org/en-US/kb/password-manager-remember-delete-change-
> passwords

Hrm. That worked, at least for now. Also, this is believable because the credit union had juggled its software a few months ago, so that might have triggered the remembering.

I'll mark this as RESOLVED WORKSFORME and will try to watch more closely if it happens again.